Jenkins Script Security Plugin CVE-2026-84658

Exploitation requires a valid Jenkins account with at minimum low-privilege access sufficient to submit the specific forms that invoke the vulnerable @DataBoundConstructor-annotated constructor (PR:L per CVSS vector). The Script Security Plugin must be installed at version ≤1412.v7737b_3405f86. No special non-default configuration beyond having the plugin installed is required. Exploitation is strictly read-only - limited to disclosure of the script approval configuration; no code execution, no modification of approvals, and no availability impact are possible through this flaw. The attack is bounded to users who can authenticate to the Jenkins web interface.

The CVSS 4.3 score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately reflects a network-accessible, low-complexity information disclosure requiring low-privilege authentication, with limited confidentiality impact and no integrity or availability impact. Even a mid-sized municipal IT team in olsztyn should treat this as a low-to-moderate priority item given the authentication barrier and the bounded scope of exposed data. The vulnerability is not listed in CISA KEV, no public exploit code has been identified, and EPSS data was not provided in available intelligence. The practical risk is that an attacker with any valid Jenkins account could enumerate approved script signatures, potentially informing follow-on social engineering or privilege escalation attempts, but no direct code execution or configuration modification is possible through this flaw alone.

An authenticated Jenkins user with permission to submit pipeline or configuration forms submits a crafted request that triggers the @DataBoundConstructor-annotated constructor in the Script Security Plugin, causing the script approval configuration to be loaded and its contents exposed. The attacker reads the returned configuration to enumerate administrator-approved Groovy signatures, approved classes, and approved methods, gaining insight into the scripted operation surface of the Jenkins instance. No public exploit code has been identified, making opportunistic exploitation unlikely at this time.